Regulation on the audit of non-bank payment service providers

Note: The translation is unofficial, for information purpose only REGULATION on the audit of non -bank payment service providers Published in the Official Monitor of the Republic of Moldova No 459 -461 of 7.11.2024, Article 872 Amended by: EBD of the NBM no. 229 of 02.10.2025, OM of the RM no. 523 -525/132 of 09.10.2025, in force from 09.04.2026 APPROVED by the Decision of the Executive Board of the National Bank of Moldova No 267 of October 31 2024 (in force from 7.11.2024) Chapter I GENERAL PROVISIONS

1. The Regulation on the audit of non -bank payment service providers (hereinafter - the Regulation) establishes the normative framework for conducting the audit of financial statements of non -bank payment service providers, namely: the requirements for the a udit entity, including the procedure for documentation and communication between the audit entity, the National Bank of Moldova and non -bank payment service providers, as well as the approval process and the withdrawal of approval for the audit entity.

2. The notions and expressions used in this Regulation shall have the meanings set out in Law No 114/2012 on payment services and electronic money (hereinafter - Law No 114/2012), the Regulation on licensing and registration of payment institutions, electroni c money institutions and postal service providers acting as payment service providers and/or electronic money issuers, approved by Decision No 11/2024 of the Executive Board of the National Bank of Moldova and Law No 271/2017 on the audit of financial s tatements (hereinafter - Law No 271/2017). The following terms and abbreviations shall also be used for the purposes of this Regulation: 2.1. ACCA (Association of Chartered Certified Accountants) ; 2.2. ACCA Qualification - authorized accountant, qualification conferred by ACCA; 2.3. CAP (Certified Accountant Practitioner) ; 2.4. CIPA (Certified International Professional Accountant) ; 2.5. Accounting standards - has the meaning defined in Article 3 of the Law on accounting and financial reporting No 287/2017; 2.6. Financial sector entity - has the meaning defined in Article 3 of Law No 202/2017 on the activity of banks.

3. The audit entity that will perform the audit of the non -bank payment service provider is approved by the National Bank of Moldova before the audit contract with the non -bank payment service provider is concluded.

4. The audit entity conducts the audit of financial statements of non -bank payment service providers in accordance with the audit legislation, Law No 114/2012 and this Regulation. Chapter II REQUIREMENTS FOR THE AUDIT ENTITY Section 1 Requirements for the audit entity and the audit entity team

5. The National Bank of Moldova approves the audit entity for performing the audit of financial statements of non -bank payment service providers, which cumulatively meets the following criteria: 5.1. Has at least 3 years of experience in the audit of financial statements; 5.2. Has not had the approval to perform the audit withdrawn by a supervisory authority for non -compliance with the provisions of the legal framework in the banking and/or non - banking sector in the last 3 years; 5.3. The audit entity team designated for the audit engagement meets the following conditions: 5.3.1. at least one -third of the audit entity team has a minimum of 3 years of experience in the audit of financial statements; 5.3.2. at least one auditor holds one of the following certificates of qualification for accountants ACCA Qualification, CIPA, or CAP; 5.3.3. at least one member of the audit entity team has at least 1 year in the audit of financial sector entities; 5.4. In the 3 years prior to the submission of the application, the audit entity/the members of the audit entity team appointed for the respective audit engagement have not been subject to any disciplinary measures under Law No 271/2017, other than a writt en warning; 5.5. The audit entity has not been appointed by the non -bank payment service provider for a period exceeding 3 consecutive years, in accordance with Article 30 paragraph (1) of Law No 114/2012; 5.6. The audit entity has no close links with the non -bank payment service provider to be audited; 5.7. The audit entity complies with the requirements regarding the form and content of the audit contract specified in point 6.

6. The audit contract is concluded in written form for a period not exceeding the term stipulated in Article 30 paragraph (1) of Law No 114/2012 and contains at least the following: 6.1. The objective and scope of the audit; 6.2. The obligation of the audit entity to prepare/issue the auditor's report in accordance with the auditing standards, as well as to prepare the letter addressed to the governing body of the non -bank payment service provider, and to submit them, within 1 20 days from the last day of the reporting period to the governing body of the non -bank payment service provider and the National Bank of Moldova; 6.3. The reporting period for which the financial statements are audited; 6.4. The obligation of the audit entity to notify the non -bank payment service provider of any changes to the information related to the criteria specified in point 5 within 5 working days

from the date of the change, as well as of the intention to modify the composition of the audit team, along with the information referred to in subpoint 8.5.; 6.5. The obligation of the audit entity to transmit to the National Bank of Moldova the information obtained during the audit engagement in the situations referred to in Article 30 paragraph (2) of Law No 114/2012 and the fact that this does not constitute a breach of the obligation to maintain the confidentiality of information relating to the activity of the non -bank payment service provider, which is incumbent on the audit entity according to the law or contractual clauses and cannot entail liability of any kind on the part of the audit entity. 7. The letter addressed to the governing body/member of the governing body of the non - bank payment service provider, as referred to in subpoint 6.2. shall include, at a minimum, the information arising from the audit of financial statements that is relevan t to the management of the non -bank payment service provider. This information shall include, but not be limited to, material misstatements of information contained in the audited financial statements that have been corrected, deficiencies in internal cont rol, qualitative aspects of accounting practices, the views on accounting estimates for items for which estimates are critical, and any other information considered relevant by the audit entity. Section 2 The procedure for the approval/withdrawal of the audit entity’s approval 8. In order to obtain the approval of the National Bank of Moldova, the non -bank payment service provider submits to the National Bank of Moldova an application for the approval of the audit entity, enclosing the following documents and information: 8.1. An extract from the minutes of the general meeting of shareholders/partners of the non-bank payment service provider or, as applicable, from the governing body authorized by law, in which the decision on the confirmation/appointment of the audit entit y for conducting the audit of financial statements was made; 8.2. A description of the planned activities schedule of the audit entity for the planned management period; 8.3. A sworn declaration affirming the absence of close links between the audit entity and the non -bank payment service provider, signed by the partner responsible for the engagement/the lead of the audit entity; 8.4. The agreed draft of the audit contract to be concluded between the non -bank payment service provider and the audit entity, and which includes the requirements specified in point 6; 8.5. Information on the education/professional training and experience of the members of the audit entity's team in the audit of financial statements, as referred to in point 5, with copies of supporting documents attached, certified as true copies of the original by the signature , handwritten or electronic qualified , of the governing body/member of the governing body of the non -bank payment service provider. This information will contain at least: 8.5.1. name, surname; 8.5.2. position held within the audit entity; 8.5.3. area of responsibilities within the audit entity team; 8.5.4. information about education/certifications (name of institution, year, series and number of diploma/certificate); 8.5.5. details of experience in the audit field (name of entity, year of participation, area of responsibilities within the audit entity team);

8.6. Confirmation issued by the Public Oversight Board of the audit regarding the absence of disciplinary measures, other than a written warning, applied to the audit entity/the audit entity's auditors appointed for the audit engagement over the last 3 yea rs. 9. The application, as well as the attached documents and information specified in point 8, are drawn up in Romanian and submitted to the National Bank of Moldova in copies, certified as true copies of the original by handwritten or qualified electronic signature of the governing body/member of the governing body of the non -bank payment service provider, within 20 working days from the confirmation/appointment of the audit entity by the general meeting of shareholders/partners of the non -bank payment servic e provider or, as applicable, by the management body authorized by law. 10. The National Bank of Moldova verifies the completeness of the documents and information specified in point 8 within 5 working days from the date of their receipt , having the right to request from the non -bank payment service provider the submission of any documents listed in point 8, in original form, whenever it deems necessary . 11. If, following the completeness check, it is found that the submitted documents and information are incomplete, or where applicable, the original documents must be submitted in accordance with point 10, the National Bank of Moldova will inform the non -bank payment service provider in writing about the missing documents and information and/or for which the original must be presented . The non -bank payment service provider, within 15 working days from the date of receipt of the letter from the National Bank of Moldova, shall complete and submit to the National Bank of Moldova the requested documents and/or information. 12. If the non -bank payment service provider fails to submit the missing documents and/or information and/or the original documents requested in accordance with point 10 within the time limit referred to in point 11, the National Bank of Moldova will inform the non -bank payment service provider about the termination of the administrative procedure. 13. The National Bank of Moldova shall, within 30 days from the date of receipt of the complete set of documents and information, approve or refuse to approve the nominated audit entity, informing the non -bank payment service provider in writing about its dec ision. 14. The National Bank of Moldova may request additional documents and information and may consult public authorities and other legal entities regarding the activity of the audit entity and/or the members of the audit entity team. The deadline for the adminis trative procedure specified in point 13 is suspended, in accordance with Article 81 of the Administrative Code No 116/2018. 15. The non -bank payment service provider is obliged to submit the additional information and documents requested under point 14 within the deadline specified by the National Bank of Moldova. 16. The decision of the National Bank of Moldova on the refusal to approve the audit entity shall indicate the ground(s) on the basis of which the approval of the audit entity appointed by the non -bank payment service provider is refused. The grounds for refu sal are: 16.1. Submission of contradictory and/or erroneous information and documents to the National Bank of Moldova for the decision on the approval of the audit entity; 16.2. Non -compliance of the audit entity with at least one of the criteria and requirements specified in point 5 and in Article 30 paragraph (1) of Law No 114/2012. 17. The non -bank payment service provider, during the period of provision of audit services by the audit entity, is obliged to notify the National Bank of Moldova in writing, within 3 working days from the day of becoming aware of any change in the documents and

information submitted during the approval process of the audit entity, including the change in the composition of the audit entity team. The National Bank of Moldova will assess the information within 10 working days, informing the non -bank payment service provider in writing, within that period, of the compliance/non -compliance of the audit entity/audit team appointed for the audit engagem ent with the criteria and requirements specified in points 5 and 6. 18. If the audit entity does not properly fulfil its obligations under Law No 114/2012, no longer meets the criteria and requirements specified in points 5 and 6 and/or no longer complies with the requirements of ethical and professional conduct as decided by the Public Oversight Board, the National Bank of Moldova shall withdraw the approval or may grant a period for the removal of the non -compliances and deficiencies. 19. If the audit entity fails to remove the non -compliances and deficiencies identified within the period set by the National Bank of Moldova, the National Bank of Moldova shall withdraw the approval granted to the audit entity. 20. If the approval of the audit entity is withdrawn or a period is granted for the removal of non -compliances and deficiencies found, the National Bank of Moldova shall notify the non - bank payment service provider of the decision taken in this regard and th e reason for the decision. 21. After informing the non -bank payment service provider of the refusal to approve the audit entity or the withdrawal of the approval granted to the audit entity in accordance with points 13, 18 or 19, as the case may be, the non -bank payment service provide r shall promptly convene the general meeting of shareholders/partners or, as applicable, the governing body empowered by law, for the confirmation/appointment of another audit entity. Chapter III OBLIGATIONS OF THE AUDIT ENTITY APPROVED BY THE NATIONAL BANK OF MOLDOVA 22. The audit entity submits, in original, to the National Bank of Moldova and to the governing body/member of the governing body of the non -bank payment service provider, within 120 days from the end of the reporting period, the auditor's report and the lett er addressed to the management of the non -bank payment service provider, which are signed on behalf of the audit entity by the head of the audit entity and the auditor/partner responsible for the audit engagement , with the financial statements attached . 23. The non -bank payment service provider facilitates the complete and timely submission by the audit entity of the documents and information required by the National Bank of Moldova in accordance with this Regulation. 24. The non -bank payment service provider keeps the original of the documents specified in point 22 at its premises. 25. The audit entity informs the National Bank of Moldova of any fact or decision related to the non -bank payment service provider audited in accordance with Article 30 paragraph (2) of Law No 114/2012.